The latest wave of cyberattacks shows how attackers are increasingly using legitimate software as a weapon, as in a recent incident the Velociraptor forensic utility was misused to tunnel Visual Studio Code through Windows and a Cloudflare environment, enabling silent access and execution of code without directly inserting their own malware. Researchers link this modus operandi to preliminary stages of ransomware and emphasize that the chain began with msiexec retrieving an installer from a worker domain, after which additional payloads followed the same route.
The market for attacks is simultaneously shifting to collaboration platforms where trust is high, as multiple security firms describe campaigns that use Microsoft Teams to pose as a help desk and get victims to install remote tools, after which PowerShell scripts harvest login credentials and build persistence. Microsoft previously warned that abuse of Quick Assist and Teams converge into social engineering chains that lead to ransomware, while recent reports indicate that criminals are even bypassing e mail filters because the initial approach is not through mail.
We also see a step forward in deception in phishing, as Push Security researchers show that attackers with a proprietary Microsoft tenant and ADFS can create legitimate-looking redirects from outlook dot office dot com, landing victims on a mimicked login page and making URL checks less supportable, extra dangerous when malvertising and typos in searches drive the first click. Public warnings call this not a Microsoft flaw but an exploitation of trusted routes that makes detection more difficult.
The street reality in the SOC therefore calls for detections that track behavior rather than just lists of known threats, with attention to unexpected installation of Velociraptor, opening VS Code in tunnel mode, msiexec pointing to worker domains and sudden Teams calls from new or compromised tenants, while audit logs such as ChatCreated and MessageSent and network traffic to tunnel services provide early context. Incident response teams recommend writing EDR rules on these living off the land patterns, enriching logs around remote tooling and practicing rollback and isolation so that precious hours are not lost later.
Suriname achieves the fastest results when industry and government prioritize three practice steps, cheap in implementation and effective in preventing misery. Put policies in place by default on endpoints that block unknown management tools or require additional approval. Monitor for anomalous use of regular tools such as msiexec and Visual Studio Code and establish with vendors that access through Teams is first verified with a callback protocol outside the platform. This way, production can continue to run when the next campaign comes back in by a trusted route.
